Clone a Content Search in the Office 365 Security & Compliance Center

Creating a Content Search in Office 365 Security & Compliance Center that searches a lot of mailboxes or SharePoint and OneDrive for Business sites can take awhile. Specifying the sites to search can also be prone to errors if you mistype a URL. To avoid these issues, you can use the Windows PowerShell script in this article to quickly clone an existing Content Search. When a you clone a search, a new search (with a different name) is created that contains the same properties (such as the content locations and the search query) as the original search. Then you can edit the new search (by changing the keyword query or the date range) and run it.

Why clone Content Searches?

  • To compare the results of different keyword search queries run on the same content locations.

  • To save you from having to re-enter a large number of content locations when you create a new search.

  • To decrease the size of the search results; for example, if you have a search that returns too many results to export, you can clone the search and then add a search condition based on a date range to reduce the number of search results.

Here's an overview of the process:

Step 1: Run the script to clone a Content Search

Step 2: Edit and run the Content Search in the Security & Compliance Center

Before you begin

  • You have to be a member of the eDiscovery Manager role group in the Security & Compliance Center to run the script described in this topic.

  • The script includes minimal error handling. The primary purpose of the script is to quickly clone a content search.

  • The script creates a new Content Search, but doesn't start it.

  • This script takes into account whether the Content Search that you're cloning is associated with an eDiscovery case. If the search is associated with a case, the new search will also be associated with the same case. If the existing search isn't associated with a case, the new search will be listed on the Content search page in the Security & Compliance Center.

  • The sample script provided in this topic isn’t supported under any Microsoft standard support program or service. The sample script is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.

Return to top

Step 1: Run the script to clone a search

The script in this step will create a new Content Search by cloning an existing one. When you run this script, you'll be prompted for the following information:

  • Your user credentials    The script will use your credentials to connect to the Security & Compliance Center for your Office 365 organization with Windows PowerShell. As previously stated, you have to be a member of the eDiscovery Manager role group in the Security & Compliance Center to run the script.

  • The name of the existing search    This is the Content Search that you want to clone.

  • The name of the new search that will be created    If you leave this value blank, the script will create a name for the new search that is based on the name of the search that you're cloning.

To clone a search:

  1. Save the following text to a Windows PowerShell script file by using a filename suffix of .ps1; for example, CloneSearch.ps1.

    # This PowerShell script clones an existing Content Search in the Office 365 Security & Compliance Center
    
    # Get login credentials from the user
    if(!$UserCredential)
    {
        $UserCredential = Get-Credential
        $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid -Credential $UserCredential -Authentication Basic -AllowRedirection
    
        if (!$Session)
        {
            Write-Error "Couldn't create a remote PowerShell session."
            return
        }
    
        Import-PSSession $Session -AllowClobber -DisableNameChecking
        $Host.UI.RawUI.WindowTitle = $UserCredential.UserName + " (Office 365 Security & Compliance Center)"
    }
    
    # Ask for the name of the search you want to clone
    $searchName = Read-Host 'Enter the name of the search that you want to clone'
    
    # Ask for the name of the new search
    $newSearchName = Read-Host 'Enter a name for the new search [leave blank to automatically generate a name]'
    
    
    $originalSearch = Get-ComplianceSearch $searchName -EA SilentlyContinue
    
    # Make sure we have a valid search before continuing
    if(!$originalSearch)
    {
        Write-Error "Couldn't find search: $searchName"
        return
    }
    
    $searchNameCounter = 1
    # Find a suitable name for the new search
    while(!$newSearchName)
    {
        $newSearchName = $originalSearch.Name + "_" + $searchNameCounter
    
        $tempSearch = Get-ComplianceSearch $newSearchName -EA SilentlyContinue
        if ($tempSearch)
        {
            $newSearchName = $null
            $searchNameCounter++
        }
    }
    
    $caseName
    # Determine if the search is part of a case; if so get the case name
    if ($originalSearch.CaseId)
    {
        $searchCase = Get-ComplianceCase $originalSearch.CaseId
        $caseName = $searchCase.Name
    }
    
    # Need to cast this value as a Boolean the old fashion way
    $allowNotFoundExchangeLocationsEnabled = $false
    if ($originalSearch.AllowNotFoundExchangeLocationsEnabled)
    {
        $allowNotFoundExchangeLocationsEnabled = $true
    }
    
    # Need to handle this switch different
    if ($originalSearch.IncludeUnindexedItems)
    {
        $newSearch = New-ComplianceSearch -Name $newSearchName -AllowNotFoundExchangeLocationsEnabled $allowNotFoundExchangeLocationsEnabled -Case $caseName -ContentMatchQuery $originalSearch.ContentMatchQuery -Description $originalSearch.Description -ExchangeLocation $originalSearch.ExchangeLocation -ExchangeLocationExclusion $originalSearch.ExchangeLocationExclusion -IncludeUnindexedItemsEnabled -Language $originalSearch.Language -SharePointLocation $originalSearch.SharePointLocation -SharePointLocationExclusion $originalSearch.SharePointLocationExclusion -PublicFolderLocation $originalSearch.PublicFolderLocation
    }
    else
    {
        $newSearch = New-ComplianceSearch -Name $newSearchName -AllowNotFoundExchangeLocationsEnabled $allowNotFoundExchangeLocationsEnabled -Case $caseName -ContentMatchQuery $originalSearch.ContentMatchQuery -Description $originalSearch.Description -ExchangeLocation $originalSearch.ExchangeLocation -ExchangeLocationExclusion $originalSearch.ExchangeLocationExclusion -Language $originalSearch.Language -SharePointLocation $originalSearch.SharePointLocation -SharePointLocationExclusion $originalSearch.SharePointLocationExclusion -PublicFolderLocation $originalSearch.PublicFolderLocation
    }
    
    if ($newSearch)
    {
        Write-Host $newSearch.Name "was successfully created" -ForegroundColor Yellow
    }
  2. Open Windows PowerShell and go to the folder where you saved the script.

  3. Run the script; for example:

    .\CloneSearch.ps1
  4. When prompted for your credentials, enter your email address and password, and then click OK.

  5. Enter following information when prompted by the script. Type each piece of information and then press Enter.

    • The name of the existing search.

    • The name of the new search.

    The script creates the new Content Search, but doesn't start it. This gives you a chance to edit and run the search in the next step. You can view the properties of the new search by running the Get-ComplianceSearch cmdlet or by going to the Content search or eDiscovery page in the Security & Compliance Center, depending on whether or not the new search is associated with a case.

Return to top

Step 2: Edit and run the cloned search in the Security & Compliance Center

After the you've run the script to clone an existing Content Search, the next step is to go to the Security & Compliance Center to edit and run the new search. As previously stated, you can edit a search by changing the keyword search query and adding or removing search conditions. For more information, see:

Return to top

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×